Add global nodeSelector (#9339)

Allow a global node selector to apply to all pods in the kyverno Helm chart

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

charts/kyverno/Chart.yaml

@@ -31,6 +31,10 @@ annotations:
   artifacthub.io/links: |
     - name: Documentation
       url: https://kyverno.io/docs
+  # valid kinds are: added, changed, deprecated, removed, fixed and security
+  artifacthub.io/changes: |
+    - kind: added
+      description: Add global nodeSelector
 dependencies:
   - name: grafana
     version: "0.0.0"

charts/kyverno/README.md

@@ -728,6 +728,7 @@ The chart values are organised per component.
 | global.caCertificates.data | string | `nil` | Global CA certificates to use with Kyverno deployments This value is expected to be one large string of CA certificates Individual controller values will override this global value |
 | global.caCertificates.volume | object | `{}` | Global value to set single volume to be mounted for CA certificates for all deployments. Not used when `.Values.global.caCertificates.data` is defined Individual  controller values will override this global value |
 | global.extraEnvVars | list | `[]` | Additional container environment variables to apply to all containers and init containers |
+| global.nodeSelector | object | `{}` | Global node labels for pod assignment. Non-global values will override the global value. |
 | nameOverride | string | `nil` | Override the name of the chart |
 | fullnameOverride | string | `nil` | Override the expanded name of the chart |
 | namespaceOverride | string | `nil` | Override the namespace the chart deploys to |

charts/kyverno/ci/nodeSelector-global-values.yaml

@@ -0,0 +1,7 @@
+global:
+  nodeSelector:
+    node-role.kubernetes.io/foo: ''
+
+admissionController:
+  nodeSelector:
+    node-role.kubernetes.io/bar: ''

charts/kyverno/templates/admission-controller/deployment.yaml

@@ -35,7 +35,7 @@ spec:
       securityContext:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}
-      {{- with .Values.admissionController.nodeSelector }}
+      {{- with .Values.admissionController.nodeSelector | default .Values.global.nodeSelector }}
       nodeSelector:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}

charts/kyverno/templates/background-controller/deployment.yaml

@@ -36,7 +36,7 @@ spec:
       securityContext:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}
-      {{- with .Values.backgroundController.nodeSelector }}
+      {{- with .Values.backgroundController.nodeSelector | default .Values.global.nodeSelector }}
       nodeSelector:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}

charts/kyverno/templates/cleanup-controller/deployment.yaml

@@ -36,7 +36,7 @@ spec:
       securityContext:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}
-      {{- with .Values.cleanupController.nodeSelector }}
+      {{- with .Values.cleanupController.nodeSelector | default .Values.global.nodeSelector }}
       nodeSelector:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}

charts/kyverno/templates/cleanup/cleanup-admission-reports.yaml

@@ -64,7 +64,7 @@ spec:
           tolerations:
             {{- tpl (toYaml .) $ | nindent 12 }}
           {{- end }}
-          {{- with .Values.cleanupJobs.admissionReports.nodeSelector }}
+          {{- with .Values.cleanupJobs.admissionReports.nodeSelector | default .Values.global.nodeSelector }}
           nodeSelector:
             {{- tpl (toYaml .) $ | nindent 12 }}
           {{- end }}

charts/kyverno/templates/cleanup/cleanup-cluster-admission-reports.yaml

@@ -64,7 +64,7 @@ spec:
           tolerations:
             {{- tpl (toYaml .) $ | nindent 12 }}
           {{- end }}
-          {{- with .Values.cleanupJobs.clusterAdmissionReports.nodeSelector }}
+          {{- with .Values.cleanupJobs.clusterAdmissionReports.nodeSelector | default .Values.global.nodeSelector }}
           nodeSelector:
             {{- tpl (toYaml .) $ | nindent 12 }}
           {{- end }}

charts/kyverno/templates/hooks/post-upgrade.yaml

@@ -62,7 +62,7 @@ spec:
       tolerations:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}
-      {{- with .Values.policyReportsCleanup.nodeSelector }}
+      {{- with .Values.policyReportsCleanup.nodeSelector | default .Values.global.nodeSelector }}
       nodeSelector:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}

charts/kyverno/templates/hooks/pre-delete.yaml

@@ -44,7 +44,7 @@ spec:
       tolerations:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}
-      {{- with .Values.webhooksCleanup.nodeSelector }}
+      {{- with .Values.webhooksCleanup.nodeSelector | default .Values.global.nodeSelector }}
       nodeSelector:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}

charts/kyverno/templates/reports-controller/deployment.yaml

@@ -36,7 +36,7 @@ spec:
       securityContext:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}
-      {{- with .Values.reportsController.nodeSelector }}
+      {{- with .Values.reportsController.nodeSelector | default .Values.global.nodeSelector }}
       nodeSelector:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}

charts/kyverno/values.yaml

@@ -29,6 +29,8 @@ global:
   # extraEnvVars:
   # - name: HTTPS_PROXY
   #   value: 'https://proxy.example.com:3128'
+  # -- Global node labels for pod assignment. Non-global values will override the global value.
+  nodeSelector: {}
 
 # -- (string) Override the name of the chart
 nameOverride: ~